OpenOTP RADIUS Bridge and VPN Security
OpenOTP Radius Bridge
Protect your Virtual Private Networks
OpenOTP RADIUS Bridge provides the RADIUS RFC-2865 (Remote Authentication Dial-in User Service) API for your OpenOTP server.
Secure your VPN endpoint
RADIUS Bridge supports several password mechanisms to handle a two-factor authentication and by design, some One-Time Password methods like on-demand SMS-OTP work better with a challenge-response mechanism.
You can also choose whether the users should be challenged the OTP password after having entered their domain password or should enter the password and the OTP in a concatenated form.
RADIUS Bridge supports single-factor authentication with password-only or OTP-only too. The OpenOTP authentication policies are very flexible and can be configured on a per-client basis in WebADM. Moreover, the client policies can be contextual to the network or geolocation of the users accessing your systems.
This flexibility also provides support for integrations where the first factor is handled by your AD servers and the second factor (the OTP) is handled by your OpenOTP server.
The RADIUS standard is supported by all major security products on the market. You can also implement OpenOTP authentication methods for:
VPN Servers (Checkpoint, Cisco ISE/ASA, F5, Fortigate, Palo Alto…)
Microsoft VPN, TMG, UAG
Citrix (Access Gateway, XenApp, Netscaler)
NAC Enterprise Wifi (EAP-TLS/GTC, TTLS)
Radius-enabled Linux services (OpenVPN, Apache…)
SWIFT Alliance Access
And many others…
RADIUS integrations support all OpenOTP features
100% compatible with RADIUS standard (RFC-2865)
Robust implementation built-in with FreeRadius
Many integrations including enterprise Wifi
OTP with challenge-response or password concatenation
Supports any RADIUS vendor dictionary
Supports MS Domain-style login names (i.e. Domain\Username)
Supports MS User Principal Names
Supports OpenOTP contextual authentication
Per user and group reply attributes for VPNs (ACL, roles)
Authentication policies per client application or group of users
Bridges all the OpenOTP functionalities (Tokens, Yubikey, SMSOTP, MailOTP…)
Standalone service with no additional OpenOTP configuration required
High performance with hundreds of requests per second
Cluster support with multiple bridges for HA
VPN Authentication with OpenOTP and Radius Bridge
See below the OpenOTP RADIUS architecture diagrams. Scenario one shows a typical OpenOTP integration with an enterprise VPN server. Scenario two includes the WAProxy mobile-to-server communication component which is necessary to enable OpenOTP Push login with Approve/ Deny notifications.
See how simple it is to use OpenOTP RADIUS Bridge:
Choose the method that best suits you